CVE-2019-1208: Microsoft Windows VBScript Array Use-After-Free Remote Code Execution Vulnerability
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1236.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the Filter and Join functions in VBScript. By performing actions in VBScript, an attacker can cause a pointer to be reused after it has been freed. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1208?
CVE-2019-1208 has a critical severity rating as it allows for remote code execution.
How do I fix CVE-2019-1208?
To fix CVE-2019-1208, you should apply the security updates provided by Microsoft for the affected software.
Which versions of Internet Explorer are affected by CVE-2019-1208?
CVE-2019-1208 affects Internet Explorer versions 9, 10, and 11.
Can CVE-2019-1208 be exploited remotely?
Yes, CVE-2019-1208 can be exploited remotely by attackers to execute arbitrary code.
Is Windows 10 vulnerable to CVE-2019-1208?
No, Windows 10 and its various versions are not vulnerable to CVE-2019-1208.